Legal

Privacy Policy.

EXCAR is designed to keep your data on the device in your car. Here is exactly what that means, and what little this website collects.

Last updated 14 June 2026. EXCAR is a pre-launch product. This policy describes how we intend to handle data and will be reviewed by counsel and finalised before commercial launch. If anything here is unclear, email privacy@excar.ai before sharing data with us.

The short version

EXCAR is built to keep your data on the device in your car. Your conversations, the memory of your drives, and your owner voiceprint live on the device in your car, not on our servers. The cloud is used only when you are connected, and only for the part of a request that genuinely needs it. This website collects the minimum needed to let you reserve a unit and contact us.

This page explains, in plain language, exactly what is collected, why, who it is shared with, how long it is kept, and the choices and rights you have.

1. Who we are

EXCAR is an early-stage product built by a three-person team (see the About page). For the purposes of data-protection law, the EXCAR team is the data controller for the information described here. You can reach us about any privacy matter at privacy@excar.ai.

Because the product is pre-launch, we deliberately collect as little as possible. As EXCAR becomes a shipping product, this policy will be expanded with the specifics required at that stage (for example, a formal data-controller entity and address), and we will tell reservation-holders before any material change takes effect.

2. What this website collects

This site is a marketing and reservation site. It collects:

  • Reservation email. If you reserve a unit, we store the email address you provide so we can tell you when the first run is available and share launch news. Providing it is voluntary; without it we cannot contact you about your reservation.
  • Messages you send us. If you use the contact link or email us directly, we receive your email address and whatever you choose to write. We keep that correspondence so we can reply and follow up.
  • Technical and usage data. Like almost every website, our hosting provider automatically processes basic technical data needed to serve pages and keep the site secure, for example IP address, browser type, and the pages requested. We use aggregate, non-identifying analytics to understand which pages are useful and improve them. We do not build advertising profiles and we do not sell personal data.

We do not knowingly use third-party advertising or cross-site tracking cookies on this site. Any cookies present are strictly necessary for the site to function or for privacy-respecting, aggregate analytics.

3. What the device in your car handles

The EXCAR unit combines on-device processing with a cloud AI model for conversation. While you use it:

  • Voice and conversation. To answer you, EXCAR captures audio after the wake word and converts speech to text on the device. Understanding your request and generating a response uses a cloud AI model (see Section 4), and the reply is spoken back on the device. Audio is processed to fulfil your request and is not retained as raw recordings on our servers.
  • On-device memory. EXCAR keeps daily logs and an evolving profile of useful facts (for example your typical destinations or fuel habits) so it can be a better co-pilot over time. This memory is stored on the device and survives reboots. You can review and clear it from the companion app at any time.
  • Owner voiceprint. To recognise you and stay quiet for passengers, EXCAR creates a speaker embedding (a mathematical representation of your voice, not an audio file) from a few enrolment samples. The voiceprint stays on the device.
  • Location. When you ask for navigation or location-aware answers ("the nearest petrol station"), the device uses location for that request. It is used to serve you in the moment, not to track your movements for us.

4. When the cloud is used, and who we share data with

EXCAR sends the minimum necessary part of a request to a third-party AI service to understand your request, generate a response, or carry out an action; an internet connection is required for this step. The services we may use, and why, are:

  • Anthropic (Claude), and increasingly EXCAR LLM. For language understanding and responses. The relevant text of your request may be sent to generate a reply.
  • Spotify. Only if you choose to link your account, and only to control playback you have asked for.
  • Map / navigation and place-search providers. To resolve navigation and "nearest…" requests.
  • Resend. Our transactional email provider, used to deliver reservation and contact notifications to our team.
  • Hosting provider. Serves this website and the reservation endpoint.

These providers act as our sub-processors: they process data only to provide their service to us, under their own terms and privacy commitments. We do not sell your data to anyone, and we do not share it for their independent advertising. A current, itemised list of sub-processors will be maintained for the shipping product; email us for the latest version.

5. Legal bases for processing

Where data-protection law (such as the EU/UK GDPR) applies, we rely on the following legal bases:

  • Consent: for sending you reservation and launch emails, and for linking optional services such as Spotify. You can withdraw consent at any time.
  • Contract / steps before a contract: to register and manage your reservation.
  • Legitimate interests: to keep the site secure, prevent abuse, and understand aggregate usage, balanced against your rights.

6. How long we keep data

  • Reservation email: until the product launches and you have decided whether to buy, or until you ask us to delete it, whichever comes first.
  • Contact correspondence: for as long as needed to handle your enquiry and a reasonable period afterwards for follow-up.
  • On-device memory and voiceprint: kept on the device until you clear it from the app or reset the unit. It is under your control, not ours.
  • Technical/security logs: kept only as long as needed for security and reliability, then deleted or aggregated.

7. Security

We use reasonable technical and organisational measures to protect data, including keeping sensitive personal data (your memory and voiceprint) on the device rather than on our servers, transmitting website data over encrypted connections (HTTPS), and limiting access to the reservation list to the team. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security, but designing the product to keep data on the device is our strongest protection.

8. International transfers

Our team and our service providers are located in multiple countries, including the United States and the European Union. If you are in a region with data-transfer rules (such as the EEA, the UK, or Turkey), your information may be processed in a country with different data-protection laws. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for those transfers.

9. Children

EXCAR is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@excar.ai and we will delete it.

10. Your rights and choices

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you;
  • Correct data that is inaccurate;
  • Delete your data (for example, your reservation email);
  • Object to or restrict certain processing;
  • Port your data to another service;
  • Withdraw consent at any time; and
  • Unsubscribe from our emails using the link in any message we send.

You can clear what the device remembers directly from the app's Memory screen, at any time, without involving us. To exercise any website-related right, email privacy@excar.ai and we will respond within a reasonable time and within any period required by law. You also have the right to complain to your local data-protection authority.

If you are a California resident, we do not sell or "share" your personal information as those terms are defined under the CCPA/CPRA, and you may exercise your access and deletion rights using the same contact below.

11. Changes to this policy

We will update this policy as EXCAR grows from a pre-launch project into a shipping product. When we make a material change, we will update the date at the top and, where appropriate, notify reservation-holders by email.

12. Contact

Questions, requests, or concerns about privacy? Email privacy@excar.ai. We read every message.